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MEMORANDUM FOR THE DEPUTY MINISTER 


DEPARTMENTAL MONITORING OF PURCHASES AND ASSET DISPOSAL 
(FOR INFORMATION) 


SUMMARY OF ADVICE TO DEPUTY MINISTER 


The purpose of this memo is to inform the Deputy Minister on the internal controls related 
to the monitoring of purchases and the disposal of assets. 


BACKGROUND 


At a security briefing, the Deputy Minister(DM) was presented with a case where a DFO/CCG 
employee may have been using a Bank of Montreal (BMO) Government Acquisition Card 

(GAC) inappropriately. The DM questioned what sort of internal audits or financial checks are in 
place (especially in cases where employees do not have regular contact with supervisors) to 
ensure financial transactions are completed in accordance with rules and policy. 


According to the Treasury Board Secretariat's Management Accountability Framework best 
practice, organizations should strive to maximize the use of acquisition cards for low-dollar —« 
acquisitions an effective tool with low administrative cost. 


DFO is one of the largest GAC user in the Federal Government. Acquisition cards are used at 
DFO as a procurement and payment mechanism, there are 3500 active card holders processing 
over 250,000 transactions per year for an annual value of 140 million dollars. The department 
receives an annual acquisition card rebate of approximately 2 million dollars based on volume of 
transactions. 


i 0 
Canada 


000002 


-2- UNCLASSIFIED 


STRATEGIC CONSIDERATIONS 


Prior to issuance of an acquisition card, the user must complete the mandatory training. The 
Responsibility Centre Manager (RCM) select appropriate controls adapted to the intended use of 
the card. 


RCM (s.34) must review the GAC register and certify all transactions pertaining to their 
employees as part of the monthly acquisition card reconciliation process. 


Two monitoring processes are in place within Financial and Materiel Management Operations to 
review acquisition card transactions. A weekly random audit by the Accounting Hub and a 
monthly risk-based monitoring by the Centre of Excellence of Materiel and Procurement Services 
(MPS). 


With regards to asset disposal process, once an asset is identified as surplus by the RCM, 
Materiel Management officers proceed with the disposal in accordance with policies and 
guidelines. 


The Internal Audit Directorate (IAD) prepares annually a Risk-Based Audit Plan (RBAP) which 
contributes to the effectiveness of governance, risk management and internal controls over the 
delivery of Fisheries and Oceans Canada’s programs and corporate activities. In line with the 
RBAP, IAD has concluded the following audits related to purchases and asset disposal: 


Audit of Asset Materiel Management: Disposal of Assets (Tabled at October 25, 2018 
Departmental Audit Committee meeting (DAC)) 

Materiel Management was assessed as high risk during the annual audit planning process for the 
Department’s 2017-2020 RBAP. The audit assessed if a materiel management framework is in 
place and operating effectively to ensure assets are disposed of in compliance with applicable 
regulations, policies and directives. Overall, the audit made several recommendations to 
strengthen controls over the disposal of assets. 


Quebec Regional Audit Pilot Project 

In August 2016, IAD did an assessment of internal controls on departmental purchases made via 
acquisition cards and contracts as part of its Regional Audit Pilot Project. Observations were in 
the following areas: lack of pre-approval for purchases, lack of supporting documentation, and 
breaches of delegated financial authority. Findings were shared with the Regional Director 
General and presented at the DAC. The findings were also included in the scoping of the 
continuous auditing program. 


Audit of Fraud Risk Management (Tabled at October 25, 2018 DAC) 

In March 2014, IAD engaged the services of Deloitte to conduct a department-wide fraud risk 
assessment to inform senior management of the fraud risk exposure for the department. The Risk 
Assessment was approved at the March 2015 DAC meeting. Recommendations related to the 
following areas: medium residual risk scenarios; fraud analytics; documenting, monitoring and 
testing control activities; fraud awareness; and periodic fraud risk assessments. Meetings were 
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held with Sectors targeted by the recommendations and an integrated Management Action Plan 
was developed and approved at the March 2015 DAC meeting. 


The audit assessed the adequacy and/or effectiveness of the fraud governance and management 
framework, including a follow-up on the recommendations from the DFO fraud risk assessment 
conducted by Deloitte. Observations were made regarding the overall culture of the organization 
and the effectiveness of controls regarding acquisition cards. 


ADVICE AND RECOMMENDATIONS TO DEPUTY MINISTER 


MPS will continue monitoring all GAC transactions on a monthly basis and inform Security of 
any suspicious transactions. Work is also underway for developing a standardized verification 
process to be implemented this fiscal year. 


IAD is establishing a continuous auditing program to provide ongoing and independent 
assessments of internal control frameworks. By utilizing a methodology that employs audit 
testing procedures combined with automated tools for data extraction and analysis, it will provide 
assurance on financial and non-financial controls. The objective is to assess whether key controls 
are adequate and effective for the application of DFO's Financial Management Framework. 


Jen O'Donouffíue 
Chief Financial Officer 
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